Configuring Dynamic Host Settings for AIX

Previously, when host settings were changed, currently executing processes for the specified images were not modified. Only when a new process started would the changed host settings take effect. To make an already running process use the new host setting values, you had to terminate the process and restart it. The Dynamic Host Setting feature now permits the modified host settings take effect when the new entries are pushed from the CipherTrust Manager to the agent.

If the Dynamic Host Setting feature is enabled, then when a host setting is altered, all running processes with that signature are affected and their existing security attributes are modified to the new host settings parameters. Future actions by a process will contain authorization(s) derived from the new attributes. It is important to note that all descendent processes are affected by a process's host setting change. If an existing host setting entry is modified, the same situation occurs.

If an existing process did not have a host setting and one is applied, then all processes with that signature are updated with the new values. All of the existing descendent processes are affected by the changes. New child processes inherit the host setting parameters and authorizations.

In v7.2 of CTE, three new vmadmin commands are provided to enable, disable, and report the status of the Dynamic Host Settings:

• To turn on dynamic host settings, type:

   voradmin secfs config dhs_on 1
  

  You must restart the agent for this to setting to take effect.

• To turn off dynamic host settings, type:

   voradmin secfs config dhs_on 0
  

  You must restart the agent for this to setting to take effect.

• To report the state of the dynamic host settings, type:

   voradmin secfs config dhs_state
  

  State information is added to the secfs.log file.

• To immediately enable dynamic host settings without restarting the agent, type:

   voradmin cmd dhs_enable
  

  You must restart the agent for this to setting to take effect. Perform this command after turning on DHS.

• To immediately disable dynamic host settings without restarting the agent, type::

   voradmin cmd dhs_enable
  

  Restarting the agent will enable it unless you turn the dynamic host settings off first.